Dashboards & Visualizations

Saved Searches Owners - too many users to display in drop down box

belka
Path Finder

I have a lot of users who have access to Splunk. When I look at the saved searches window, the drop down box to show "owner" populates with all my user base. Consequently, the drop down box does not show all the users, only about half way through the user list. Is there a way to make that drop down list longer so that it displays all users?

1 Solution

MuS
SplunkTrust
SplunkTrust

Hi belka and ahartge,

like everything in Splunk, this is set in a file. The file you're looking for is $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py and on line 1666 you will see this:

# per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here?
pwnrList = en.getEntities("authentication/users", count=250, search="roles=*")

There was a reason (SPL-24818) to cap this and obviously you can change it back here as well. But be aware that any future Splunk update could/will overwrite this file and change it back to the value count=250.

hope this helps ...

cheers, MuS

and remember if you break stuff, you have to fix it 😉

View solution in original post

tthrockm
Explorer

Glad to have found this fix, but patching Splunk's code (vs. maintaining config state) is not really maintainable for most users. A similar issue exists in data/ui/views/job_management.xml. Many enterprises have more than 250 users, and this seems like something that should be a configuration option.

I'd also point out that you can workaround the hardcoded limit w/out modifying the code by entering the desired userid in the search input (not as clean) or manually modify the url, replacing &pwnr=- with &pwnr=targetuserid

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi belka and ahartge,

like everything in Splunk, this is set in a file. The file you're looking for is $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py and on line 1666 you will see this:

# per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here?
pwnrList = en.getEntities("authentication/users", count=250, search="roles=*")

There was a reason (SPL-24818) to cap this and obviously you can change it back here as well. But be aware that any future Splunk update could/will overwrite this file and change it back to the value count=250.

hope this helps ...

cheers, MuS

and remember if you break stuff, you have to fix it 😉

ahartge
Path Finder

I also see this issue on 5.0.4 & 6.1 (250 users only) I havent found a solution or answer yet.

0 Karma

chris
Motivator

Have you ever found an answer to this issue? I'm on 6.0.3 and only see 250 + any + nobody out of about 500 Users

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...